EMAIL
HEALTH.
Inspect a domain's public email configuration in one workflow. The result describes observable records and policies; it does not send messages and does not guarantee inbox delivery.
The portal does not send email, measure sender reputation or guarantee deliverability. Enter the active DKIM selector to check the published key; without a selector DKIM is reported as not evaluated.
DNS lookup budget and selector hints
DMARC record generator
Generate a starting record locally. Review real mail flows and reports before moving to a stricter policy.
v=DMARC1; p=none; pct=100
VIEW TECHNICAL DATA
RECENT LOCAL QUERIES
Frequently asked questions
What does Email Health check?
The domain MX, SPF, DMARC, MTA-STS, TLS-RPT and BIMI records, plus DKIM hints. It points out what blocks or weakens delivery and spoofing protection.
Why was DKIM not found?
DKIM depends on a selector that cannot be discovered from the domain alone. The portal tries six common selectors as a hint; if yours is different, use the selector in the DKIM-Signature header of a real message.
Which DMARC policy should I use?
Start with p=none to get reports without affecting delivery. Once every legitimate sender passes aligned SPF or DKIM, move to quarantine and then reject.
My SPF needs more than 10 lookups. Is that a problem?
Yes. SPF allows at most 10 DNS lookups (include, a, mx and similar). Beyond that the result is a permanent error and receivers may treat mail as unauthenticated.
Does Email Health send a test email?
No. It only reads the domain public DNS records. To analyse a message you received, use the Email Header Analyzer.